Zumba VPPA Settlement: $2.7 Million for Online Course Tracking Data Claims

The Video Privacy Protection Act (VPPA) is a U.S. law designed to limit how companies can collect and share “video viewing” information—data that can reveal what people watched or accessed online. In this case, the lawsuit focused on whether Zumba Fitness tracked people who bought online instruction from its Zumba.com “Zumba Basic 1” course and then shared personally identifiable information with third-party advertising and analytics providers, including Meta Platforms, MNTN, and Pinterest. The settlement notice says those third-party trackers may have accessed customer data between Oct. 22, 2022, and Oct. 22, 2024, and that qualifying class members are U.S. purchasers whose identifying information appeared in order-related pages accessible to those advertisers. The class action was filed to hold Zumba accountable under the VPPA, with the claim that the tracking technologies transmitted personally identifiable information in a way that violated privacy protections. Zumba agreed to a $2.7 million settlement—even while denying wrongdoing—to reduce the cost and uncertainty of continued litigation. Under the agreement, an estimated 4,543 people may receive cash payments of at least $228.78 per qualifying “subclass” (depending on whether Meta, Pinterest, and/or MNTN could access their data), with no claim form required and payment based on how many eligible participants opt to be paid; this makes the settlement meaningful not just for the individuals involved, but as another real-world test of how VPPA protections apply to modern website tracking and ad ecosystems. Broader implications mirror a growing wave of VPPA-style lawsuits targeting cookie and pixel tracking, especially where “video-related” data may be used for targeted advertising. The settlement also reflects industry context: platforms frequently integrate third-party tags for marketing measurement, and regulators and courts have increasingly scrutinized whether those practices require user authorization and limit downstream sharing of sensitive viewing-related data. With eligibility tied to access by specific ad/measurement partners and deadlines for opting out and updating payment details, the case underscores how online course providers and other streaming- or media-adjacent businesses must carefully manage tracking tools and data flows to reduce the risk of privacy violations like those alleged here